hxxps://link-lt[.]etrailer[.]com/q/aMka5IZHQzW8V4D0Y1nee0vPxtcD1HOHuePTZcOJam9zaHLVhLmNhcmx0b25AY2VudGVycG9pbnRlbmVyZ3kuY29tw4g2lQECH7Ceof_pdWxgHjKYNNVBw

Analysis

max time kernel
258s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://link-lt.etrailer.com/q/aMka5IZHQzW8V4D0Y1nee0vPxtcD1HOHuePTZcOJam9zaHLVhLmNhcmx0b25AY2VudGVycG9pbnRlbmVyZ3kuY29tw4g2lQECH7Ceof_pdWxgHjKYNNVBw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
544	msedge.exe
544	msedge.exe
4448	identity_helper.exe
4448	identity_helper.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 956	544	msedge.exe	83
PID 544 wrote to memory of 956	544	msedge.exe	83
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 3668	544	msedge.exe	84
PID 544 wrote to memory of 468	544	msedge.exe	85
PID 544 wrote to memory of 468	544	msedge.exe	85
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86
PID 544 wrote to memory of 4256	544	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://link-lt.etrailer.com/q/aMka5IZHQzW8V4D0Y1nee0vPxtcD1HOHuePTZcOJam9zaHLVhLmNhcmx0b25AY2VudGVycG9pbnRlbmVyZ3kuY29tw4g2lQECH7Ceof_pdWxgHjKYNNVBw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe008a46f8,0x7ffe008a4708,0x7ffe008a4718
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17728493034134696016,9964940174847839291,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
6c253f12dbd126654bc4d3756b540944

SHA1
6dbc0646e4ce133e4e682cf9ba63b52194d0a90b

SHA256
f9d130d89514b5e2f9e947a43f43af2af6f4e43a19240a8fced45ddd6c11a24c

SHA512
445230cc7da7f385231a6bc9af9ad1b907dc1ffea54a86a85fb057e640dd2a5f5407da96be196c31756f4e1233f89dc7166d0b9bca42857f64b83d9c02caf7fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.etrailer.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
18c144499f3efd5f5e9ae301d7ea96e1

SHA1
ec4c479470db0fd80a0977ab09a6e45005e19bbc

SHA256
8e3cfe9788e29bd11aedd2f018decfd33ae9c5e7b2be005755fb1aa731cc40fd

SHA512
386a131b25f57f83f13a0ab5f4a530dec3150c13455a601cc9766c2e22489c6afcd5b147afec857e37c1a71d03037c86de269598e1072b028b7a3f553058c1fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9995b703b1eb1b83fe4dbb8ef23e0b10

SHA1
2bd8eb517919eafde66196ee674a53cc05b8a7ef

SHA256
801d9a2b439691c29b04d010fe91609a9602939759341f4c72bf85fdafb1508c

SHA512
29d4c3c0c14b1dd27a78972aaa585cb79169ed88ca63686bcd3e3ece623d594f545568c6f2b507363d07cbb92b49d2452c0d57206589b5ac7ecab009ec184ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
42a64900ef46a8d82ce7a112da8dfba1

SHA1
a3b7da252a2c4e6347039c798567e7479fa0545c

SHA256
c60fde5af11bb764ab55b95d827f4919407267c4ccf1a28fa7795b9d16d7c514

SHA512
414c02bc73b883453085075a4d5b3bdad98fbd6cd14334860946d7e6aa6c55219c5277f999d2c8e9b899e0f85ff1707156231b86df4186caaa85fe8865281a48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea7cf1f18f7de45b3cba9c56cca3a275

SHA1
b6576d079d69796af6db1e1da9e36397fb75d5f9

SHA256
552f6107026e12f0b1c1971d2e4cc2e270fddd156feea48a121cd8ecc8fae724

SHA512
3f61d0fbd37db60e75b9fcb4f173fafcc2e44cc2207ff82c617d015c5a9c53e521073915a81bf307376166a310b310319b4dab8576b0857d6b24687170de199d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
2984b29702fb93c62ff014c917108080

SHA1
b0b886df1601665b163bff199fa5279069d420bb

SHA256
9dae7d26f2d672ec6ac0502e134743514a4010d77d296fed088fb4dc50474ae3

SHA512
ea915c90adb46f7402c5b6a60494d96c1da73961856b94bdea03c49ec7e502e172feec7558bb3ec93b7f3d00803eb36ae0aaa708d2f3c1a0635931964d9eac95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5846a9.TMP

Filesize
48B

MD5
21838fe476977a9bb23c1bc3ab36bea1

SHA1
07a11ac187a44e11607aa03e00706c29acdc7f12

SHA256
3279ef4d32c603ec693b77e37d85ab49accb5fd34c86752be4a39e49f0cc3893

SHA512
14bb1082e8e5a822f13f1eca08aa48581f32dc0b55e002b7019f3d66f35a186fac7205154c6d3ec044df9d2af40175ce7af66a1da5337049daa908264d61110d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
41d7af45c93b7f86655ed4b222ff6f7e

SHA1
f35348a79a43abe0a8a840e29a5a5567851cee8f

SHA256
1592abe5ed2e4b6b12a980341f542ecd216112ec1577f94b7d036b1c230c8ad0

SHA512
2ecc3e666155cc09f85719c3386ac9d220a5960f232800f6a1f8ed83349762fb369755be0161950de26ae8166376f6f32fd763d36e35925087ea01edc9082d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b03.TMP

Filesize
1KB

MD5
90c038fe7952e84430b575b4dfa03fbd

SHA1
4e00da5d796905b0c135c3fa18be81ff6cdf7861

SHA256
1c249231104ddb47a30ee09debfc12358eff5ba41d5dff8e4c15c30f3351dd0f

SHA512
e9d039738f53a6c07139050c3b08cf3c30ce9bc73ce831f807065b61867f115e427ea359996073c8ed148d3a0a74f2a0aeab465395cf4e093b16486340bcef5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a34a9ff12128ecd0e7f884aa7e40cd7a

SHA1
41d4e33720327078ce5560e3534da9ad79f25032

SHA256
b9cf8f27e9feacdda32d7c039be0a193756581d97da0cf769f4873d2a379c76f

SHA512
abdc19b4a5f2f7d3b64e8fefda1772a3947d55e9e43e35e21934f76505851c4d7c032b13dfa15e4d10f368ec6ef4152b877c0ba799d0c17f35a2c9e31c549d32

Download Submit